Minimum permission boundary for IAM Role?

[fovc9]

The quickstart says this:

Ensure that the AWS user you use for this quickstart has the has the AmazonECS_FullAccess policy attached (scope down as needed for your production requirements)

I am in the process of scoping down as needed for my production requirements. What is the minimum required for a vanilla installation of the ECS variant? I know what permissions are needed to join the cluster, but I was for instance surprised that it seems the control images are downloaded via the AWS API on boot:

AccessDeniedException: User: [redacted] is not authorized to perform: ecr:BatchGetImage on resource: arn:aws:ecr:eu-west-1:328549459982:repository/bottlerocket-control because no identity-based policy allows the ecr:BatchGetImage action

Are there other permissions like this needed for a baseline install?

[stockholmux]

hey @fovc9. It's a bit challenging because you could do some... interesting things... to get to a very bare-bones install, but I don't think that's what you want.

Take a look at this ECS example, it's quite a bit more scoped down from AmazonECS_FullAccess

https://containersonaws.com/pattern/ecs-ec2-bottlerocket-cluster